"An individual would not, while using a mall directory, reasonably expect their image to be captured and used to create a biometric representation of their face, which is sensitive personal information, or for that biometric information to be used to guess their approximate age and gender," they wrote.

Genuine question - if mall had deployed people whose job was to look at people to guess their gender, age and then jot it down in a notebook, then would it have been a problem?

If not, then why this is a problem? Assuming that the 'biometric representation' is discarded by the system after guessing the age and gender.